owasp-amass/amass · error

%s is not a valid CIDR

Error message

%s is not a valid CIDR

What it means

ParseCIDRs is a flag.Value implementation for comma-separated CIDR flags. Set returns this error when the entire flag value is the empty string — the interpolated s is empty, so the message reads " is not a valid CIDR". It guards against producing an empty or meaningless []*net.IPNet.

Source

Thrown at internal/afmt/parse.go:164

func (p *ParseCIDRs) String() string {
	if p == nil {
		return ""
	}

	var builder strings.Builder
	for i, ipnet := range *p {
		if i > 0 {
			builder.WriteRune(',')
		}
		builder.WriteString(ipnet.String())
	}
	return builder.String()
}

// Set implements the flag.Value interface.
func (p *ParseCIDRs) Set(s string) error {
	if s == "" {
		return fmt.Errorf("%s is not a valid CIDR", s)
	}

	cidrs := strings.Split(s, ",")
	for _, cidr := range cidrs {
		_, ipnet, err := net.ParseCIDR(cidr)
		if err != nil {
			return fmt.Errorf("failed to parse %s as a CIDR", cidr)
		}

		*p = append(*p, ipnet)
	}
	return nil
}

func (p *ParseASNs) String() string {
	if p == nil {
		return ""
	}

View on GitHub (pinned to 79299dce87)

Solutions

1. Provide a non-empty comma-separated CIDR list such as "10.0.0.0/8,192.168.0.0/16".
2. Test the shell variable for non-emptiness before invoking.
3. Omit the flag when no CIDRs are needed.

Example fix

// before
-cidr "$CIDRS"    # CIDRS empty -> " is not a valid CIDR"
// after
-cidr "10.0.0.0/24"

func validateCIDRsFlag(value string) error {
	if strings.TrimSpace(value) == "" {
		return errors.New("flag requires a non-empty CIDR list")
	}
	for _, c := range strings.Split(value, ",") {
		if _, _, err := net.ParseCIDR(strings.TrimSpace(c)); err != nil {
			return fmt.Errorf("entry %q is not valid CIDR", c)
		}
	}
	return nil
}

func isCIDRList(s string) bool {
	if strings.TrimSpace(s) == "" { return false }
	for _, c := range strings.Split(s, ",") {
		if _, _, err := net.ParseCIDR(strings.TrimSpace(c)); err != nil { return false }
	}
	return true
}

When it happens

Trigger: Calling Set("") on a *ParseCIDRs, e.g. `-cidr "$CIDRS"` with CIDRS unset, or explicitly passing `-cidr ""`.

Common situations: Unset shell variables, templated commands with unfilled values, or attempts to clear the flag with an empty string.

Understand the failure class

Background: "unknown output mode", "invalid value for flag", "expects true/false": fixing invalid flag value errors in CLI tools — this error's family across 24 libraries.

Related errors

• failed to parse %s as a CIDR
• IP address parsing failed
• String parsing failed
• integer parsing failed
• %s is not a valid IP address or range

AI-assisted analysis of owasp-amass/amass@79299dce87 (2026-09-06). Data as JSON: /api/errors/f689fd2cba2408e9. Report an issue: GitHub.